stripe-python/.github/workflows/ci.yml at master · stripe/stripe-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
name: CI

on:
  workflow_dispatch: {}
  push:
    branches:
      - master
      - beta
      - private-preview
      - sdk-release/**
      - feature/**
    tags:
      - v[0-9]+.[0-9]+.[0-9]+*
  pull_request:
    branches:
      - master
      - beta
      - private-preview
      - sdk-release/**
      - feature/**

permissions: {}

jobs:
  lint:
    name: Static Checks
    runs-on: "ubuntu-24.04"
    permissions:
      contents: read
    steps:
      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python 3
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"
      - name: check examples w/ mypy (against python@3.13)
        run: just typecheck-examples
      # skip deps on all these since mypy installed everything
      - name: check linting
        run: just --no-deps lint
      - name: check formatting
        run: just --no-deps format-check
      # pyright depends on node, which it handles and installs for itself as needed
      # we _could_ run setup-node to make it available for it if we're having reliability problems
      - name: check types
        # only check against a modern version- unit tests will catch syntax errors on older versions
        # this isn't user facing, this is just checking that our code is internally consistent
        # e.g. a bug here wouldn't cause user CI to fail since the issue is internal to our codebase
        run: just --no-deps typecheck

  build:
    name: Build
    runs-on: "ubuntu-24.04"
    permissions:
      contents: read
    steps:
      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python 3
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.10"

      - name: Build and check package
        run: |
          just build

      - name: "Upload Artifact"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/

  test:
    name: Test (${{ matrix.python_version }}, ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os:
          - "ubuntu-24.04"
        python_version:
          # The last ~5 versions, once we're on schedule
          # https://docs.stripe.com/sdks/versioning?lang=python#stripe-sdk-language-version-support-policy
          # https://endoflife.date/python
          - "3.9"
          - "3.10"
          - "3.11"
          - "3.12"
          - "3.13"
          - "3.14"
          - "pypy-3.9"
          - "pypy-3.10"
          - "pypy-3.11"
        include:
          - os: windows-latest
            # use any modern-ish version
            python_version: "3.14"
    steps:
      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Read OpenAPI version
        id: openapi
        shell: bash
        run: echo "version=$(< OPENAPI_VERSION)" >> "$GITHUB_OUTPUT"
      - name: Set up Python ${{ matrix.python_version }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python_version }}
      - uses: stripe/openapi/actions/stripe-mock@master
        with:
          openapi_version: ${{ steps.openapi.outputs.version }}

      - name: "run tests"
        run: just test
        env:
          # Use IP instead of 'localhost' to avoid slow DNS resolution on Windows
          STRIPE_MOCK_HOST: ${{ runner.os == 'Windows' && '127.0.0.1' || 'localhost' }}

  publish:
    name: Publish
    if: >-
      ((github.event_name == 'workflow_dispatch') || (github.event_name == 'push')) &&
      startsWith(github.ref, 'refs/tags/v')
    needs: [build, test, lint]
    runs-on: "ubuntu-24.04"
    environment: publish
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download all workflow run artifacts
        # v8 errors on an artifact digest mismatch; v4 only warned. A mismatch
        # means the artifact `test` gated on isn't the one reaching PyPI, so
        # failing is right — set `digest-mismatch: warn` if it ever misfires.
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist
          path: dist
      - name: Publish packages to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: dist/
      - uses: stripe/openapi/actions/notify-release@master
        if: always()
        with:
          bot_token: ${{ secrets.SLACK_BOT_TOKEN }}